Wazuh multi-node cluster

Adding the Wazuh repository

This section describes how to add the Wazuh repository. It will be used for the Wazuh manager and Wazuh API installation. These steps must be followed in all the servers that will be part of the Wazuh multi-node cluster.

Installing the Wazuh manager

1. Install the Wazuh manager package. This step must be applied in all servers that will act as Wazuh cluster nodes:

   YumAPT

   # yum install wazuh-manager-4.5.4-1
   

Now, the Wazuh manager has been installed in all the Wazuh cluster nodes. The Wazuh manager is installed and configured in a single-node cluster by default. The following sections will describe how to configure the Wazuh manager as a Wazuh master node or Wazuh worker node.

One server has to be chosen as a master, the rest will be workers. So, the section Wazuh server master node must be applied once, in the server chosen for this role. For all the other servers, the section Wazuh server worker node must be applied.

Wazuh server master node

1. Configure the cluster node by editing the following settings in /var/ossec/etc/ossec.conf:

   <cluster>
     <name>wazuh</name>
     <node_name>master-node</node_name>
     <key>c98b62a9b6169ac5f67dae55ae4a9088</key>
     <node_type>master</node_type>
     <port>1516</port>
     <bind_addr>0.0.0.0</bind_addr>
     <nodes>
       <node>wazuh-master-address</node>
     </nodes>
     <hidden>no</hidden>
     <disabled>no</disabled>
   </cluster>
   

   The parameters:

   name	Name of the cluster.
   node_name	Name of the current node.
   key	Key that will be used to encrypt communication between cluster nodes. The key must be 32 characters long and the same for all of the nodes in the cluster. You may use the following command to generate a random key: openssl rand -hex 16
   node_type	Node type (master/worker).
   port	Destination port for cluster communication.
   bind_addr	Network IP address to which the node will be bound to listen for incoming requests (0.0.0.0 for any IP).
   nodes	The address of the master node. It must be specified in all nodes (including the master itself). The address can be either an IP or a DNS.
   hidden	Shows or hides the cluster information in the generated alerts.
   disabled	Indicates whether the node will be enabled or disabled in the cluster. This option must be set to no.

2. Once the /var/ossec/etc/ossec.conf configuration file is edited, enable and start the Wazuh manager service:

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-manager
   # systemctl start wazuh-manager
   

3. Run the following command to check if the Wazuh manager is active:

   SystemdSysV init

   # systemctl status wazuh-manager
   

Wazuh server worker nodes

1. Configure the cluster node by editing the following settings in /var/ossec/etc/ossec.conf:

   <cluster>
       <name>wazuh</name>
       <node_name>worker-node</node_name>
       <key>c98b62a9b6169ac5f67dae55ae4a9088</key>
       <node_type>worker</node_type>
       <port>1516</port>
       <bind_addr>0.0.0.0</bind_addr>
       <nodes>
           <node>wazuh-master-address</node>
       </nodes>
       <hidden>no</hidden>
       <disabled>no</disabled>
   </cluster>
   

   As shown in the example above, the following parameters have to be edited:

   node_name	Each node of the cluster must have a unique name.
   node_type	Has to be set as a worker.
   key	The key created previously for the master node. It has to be the same for all the nodes.
   nodes	Has to contain the address of the master (it can be either an IP or a DNS).
   disabled	Has to be set to no.

2. Once the /var/ossec/etc/ossec.conf configuration file is edited, enable and start the Wazuh manager service:

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-manager
   # systemctl start wazuh-manager
   

3. Run the following command to check if the Wazuh manager is active:

   SystemdSysV init

   # systemctl status wazuh-manager
   

4. To verify that the Wazuh cluster is enabled and all the nodes are connected, execute the following command:

   # /var/ossec/bin/cluster_control -l
   

   An example output of the command looks as follows:

   NAME         TYPE    VERSION  ADDRESS
   master-node  master  4.5.4   10.0.0.3
   worker-node1 worker  4.5.4   10.0.0.4
   worker-node2 worker  4.5.4   10.0.0.5
   

   Note that 10.0.0.3, 10.0.0.4, 10.0.0.5 are example IPs.

Adding the Elastic Stack repository

Filebeat installation and configuration

1. Install the Filebeat package:

   YumAPT

   # yum install filebeat-7.17.13
   

2. Download the pre-configured Filebeat config file used to forward Wazuh alerts to Elasticsearch:

   # curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/4.5/tpl/elastic-basic/filebeat.yml
   

3. Download the alerts template for Elasticsearch:

   # curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v4.5.4/extensions/elasticsearch/7.x/wazuh-template.json
   # chmod go+r /etc/filebeat/wazuh-template.json
   

4. Download the Wazuh module for Filebeat:

   # curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.2.tar.gz | tar -xvz -C /usr/share/filebeat/module
   

5. Configure Filebeat certificates:

   In section Installing Elasticsearch, the certs.zip file was created. The file must be copied into the Wazuh server host, for example, using scp. This guide assumes that the file is placed in ~/ (home user folder).

   The X must be replaced with the number defined for this Wazuh server in the instances.yml file:

   # mkdir /etc/filebeat/certs/ca -p
   # zip -d ~/certs.zip "ca/ca.key"
   # unzip ~/certs.zip -d ~/certs
   # cp -R ~/certs/ca/ ~/certs/filebeat-X/* /etc/filebeat/certs/
   # mv /etc/filebeat/certs/filebeat-X.crt /etc/filebeat/certs/filebeat.crt
   # mv /etc/filebeat/certs/filebeat-X.key /etc/filebeat/certs/filebeat.key
   # chmod -R 500 /etc/filebeat/certs
   # chmod 400 /etc/filebeat/certs/ca/ca.* /etc/filebeat/certs/filebeat.*
   # rm -rf ~/certs/ ~/certs.zip
   

6. Edit /etc/filebeat/filebeat.yml file:

   Elasticsearch single-node clusterElasticsearch multi-node cluster

   output.elasticsearch.hosts: ["<elasticsearch_ip>:9200"]
   output.elasticsearch.password: <elasticsearch_password>
   

   Replace <elasticsearch_ip> with the IP address or the hostname of the Elasticsearch server and <elasticsearch_password> with the previously generated password for elastic user.

7. Enable and start the Filebeat service:

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable filebeat
   # systemctl start filebeat
   

To ensure that Filebeat has been successfully installed, run the following command:

# filebeat test output